Ueno Bank Collapse: How Did Every Line of Defence Miss It?

Ueno bank collapsed because its balance sheet was not what published numbers suggested. After the Paraguayan central bank adjusted its financial statements, the solvency ratio fell below half the regulatory minimum. Linked party lending, weak credit files, unsupported IT service activations and liquidity pressure led to resolution, despite millions of customers and an excellent app.

Ueno Bank Collapse: How Did Every Line of Defence Miss It?Andrew Baker's Technology Blog Posts, 04/Nov/2026
https://andrewbaker.ninja/2026/11/04/ueno-bank-collapse-how-did-every-line-of-defence-miss-it/

On 29 October 2026, ueno bank told the market that its total regulatory capital ratio stood at 13.8%, comfortably above Paraguay’s 12% minimum, and announced a US$100 million plan to strengthen it further. Four days later, shortly after three o’clock on the morning of 3 November, the Banco Central del Paraguay (BCP) announced that its board had voted unanimously to place the bank into resolution because its solvency ratio had fallen below half of that minimum, which means below 6%. Customers reported that they could no longer use the bank’s app, police were posted outside branches in Asunción, and by the end of the day the central bank’s own president had resigned.

The easy article to write about Ueno is a list of what banks are supposed to do: limit related party lending, hold real capital, diversify funding, keep governance independent. Every banker already knows that list, and none of it is news. The interesting question is how a bank with roughly US$4 billion in assets, three million customers and the largest corporate bond issue in Paraguay’s history got that big while apparently failing those basics, and why every check that is supposed to catch exactly this kind of failure looked at the bank and let it carry on.

Management, the board, external ratings, international bond investors, a European strategic shareholder, the state institutions that deposited hundreds of millions with it and the central bank itself all had a view of Ueno. Most of them were looking at the same reported numbers, and the one that eventually rejected those numbers had been examining the bank for five months before it acted. That is the story worth telling, because if all of those checks can fail together in Paraguay, any bank should be asking how it would know if they were failing together inside its own walls.

Because the investigation is still in progress, I distinguish throughout between what the BCP has stated, what the bank disclosed, and what the press has reported from leaked supervisory documents. The aim is to understand how the system failed, not to assign individual blame, which is a matter for the investigators.

1. What happened

Ueno began as a finance company, received its banking licence in November 2023 and began operating as a bank on 1 December 2023, and completed its merger with Visión Banco on 28 June 2024, which brought more than 70 branches. By its own account it served more than three million people, equivalent to over 65% of Paraguay’s adult population, and in March 2026 it completed a US$350 million international bond issue, described as the largest corporate issuance in the country’s history. That is less than three years from finance company to systemically important bank.

Its published capital position looked reassuring right up to the end. The bank reported a total capital ratio of 15.01% for March; its open letter of 21 September reported 14.5% measured at June, alongside US$2.85 billion in deposits and a non performing loan ratio of 0.6%; and its 29 October capital plan cited 13.8%, without stating the measurement date. The BCP has not published an exact figure for its own finding, only that the ratio was below half the required minimum.

{
  "type": "bar",
  "data": {
    "labels": [
      "Mar 2026 (bank)",
      "Jun 2026 (bank, published 21 Sept)",
      "Cited 29 Oct (bank, date not stated)",
      "2 Nov 2026 (BCP: below 6%)"
    ],
    "datasets": [
      {
        "type": "bar",
        "label": "Total capital ratio reported by the bank (%)",
        "data": [15.01, 14.5, 13.8, null],
        "backgroundColor": "#2563eb"
      },
      {
        "type": "line",
        "label": "Regulatory minimum (12%)",
        "data": [12, 12, 12, 12],
        "borderColor": "#f59e0b",
        "borderDash": [6, 4],
        "fill": false,
        "pointRadius": 0
      },
      {
        "type": "line",
        "label": "Half the minimum (6%): BCP found the ratio below this line",
        "data": [6, 6, 6, 6],
        "borderColor": "#dc2626",
        "borderDash": [2, 3],
        "fill": false,
        "pointRadius": 0
      }
    ]
  },
  "options": {
    "plugins": {
      "title": { "display": true, "text": "Ueno capital: what the bank reported vs the BCP's finding (no exact BCP ratio published)" }
    },
    "scales": { "y": { "beginAtZero": true, "max": 18, "title": { "display": true, "text": "%" } } }
  }
}

Those dates should not be read as four days of losses. According to the BCP’s statement, the shortfall arose from adjustments made to the bank’s financial statements during the regularisation process, accumulated over a review that began on 5 June. At the press conference, BCP president Carlos Carvallo said that lending to linked parties first drew the regulator’s attention, and attributed the resolution to deteriorating liquidity, accelerated by leaks of sensitive information, and to additional provisions arising mainly from weak credit files and from what he called the activación de servicios informáticos without fully supported justification. The gap in the chart is between two views of the same balance sheet, not between two moments in its trading, and the rest of this post is about why only one of those views was visible to the outside world until the very end.

%%{init: {'theme':'base','themeVariables':{'primaryColor':'#1e293b','primaryTextColor':'#ffffff','primaryBorderColor':'#f59e0b','lineColor':'#f59e0b','fontSize':'14px'}}}%%
flowchart TD
    A["Nov to Dec 2023<br/>Banking licence granted;<br/>bank operations begin"] --> B["28 June 2024<br/>Merger with<br/>Visión Banco completed"]
    B --> C["March 2026<br/>US$350m bond issue;<br/>15.01% total capital ratio"]
    C --> D["5 June 2026<br/>BCP review begins;<br/>linked lending flagged"]
    D --> E["21 Sept 2026<br/>Bank publishes 14.5%<br/>ratio measured at June"]
    E --> F["12 Oct 2026<br/>Press reports ~US$146m<br/>to three linked companies"]
    F --> G["16 Oct 2026<br/>Fitch moves outlook<br/>to negative"]
    G --> H["29 Oct 2026<br/>US$100m capital plan;<br/>bank cites 13.8% ratio"]
    H --> I["2 Nov 2026<br/>BCP board votes<br/>for resolution"]
    I --> J["3 Nov 2026<br/>Announced overnight;<br/>BCP president resigns"]
    style A fill:#1e293b,color:#ffffff,stroke:#f59e0b
    style B fill:#1e293b,color:#ffffff,stroke:#f59e0b
    style C fill:#1e293b,color:#ffffff,stroke:#f59e0b
    style D fill:#7c2d12,color:#ffffff,stroke:#fdba74
    style E fill:#1e293b,color:#ffffff,stroke:#f59e0b
    style F fill:#1e293b,color:#ffffff,stroke:#f59e0b
    style G fill:#1e293b,color:#ffffff,stroke:#f59e0b
    style H fill:#1e293b,color:#ffffff,stroke:#f59e0b
    style I fill:#7f1d1d,color:#ffffff,stroke:#fca5a5
    style J fill:#7f1d1d,color:#ffffff,stroke:#fca5a5

2. How each line of defence missed it

2.1 Growth outran the bank’s own controls

The first line of defence is the bank itself, and Ueno’s growth path put more strain on it than almost any bank could absorb. In under three years it converted from a finance company to a bank, absorbed a larger legacy institution with its branch network and loan book, raised US$350 million internationally and, by its own account, brought more than a million Paraguayans into the banking system for the first time. Each of those is a major programme on its own; doing all of them at once means building credit processes, accounting judgements and control functions for an institution that keeps changing shape underneath them.

The merger matters particularly. ABC Color has reported, citing supervisory documents, that questions surrounded expenses held in the merger trust created for the Visión acquisition and the classification of a delinquent loan portfolio inherited with it. Those reports have not been confirmed by the regulator, but they point at a familiar pattern: an acquisition brings in assets whose true value is hard to establish, and a fast growing acquirer has every incentive to give them the benefit of the doubt.

The BCP’s reference to the activación de servicios informáticos may belong to the same pattern. In Spanish accounting usage activar commonly means to capitalise, that is, to record a cost as an asset rather than an expense; that is my reading, and the BCP has not explained the term. If it is right, the effect on regulatory capital depends on how the items were classified, because prudential rules commonly deduct intangible assets from core capital already, but the underlying lesson holds either way: capitalised technology spending is among the most judgement heavy items on a modern bank’s balance sheet, and the people best placed to judge it are usually the people who spent the money.

2.2 The supervisor saw it, and the published numbers did not change

This is the part of the story that should make any regulator uncomfortable. The BCP began its analysis of Ueno on 5 June. On Carvallo’s own account, the regulator first asked the bank to adjust its linked lending and then conducted a deeper inspection to trace the money, because it needed certainty that could not rest on indications alone. During those five months the bank published a 14.5% capital ratio, issued an open letter defending its financial position, and cited 13.8% while announcing a capital plan four days before resolution. Investors, depositors and the public were reading one set of numbers while the supervisor was assembling another.

Supervisors have legitimate reasons to move carefully: acting on incomplete evidence can itself trigger a run, and Carvallo explicitly said the leaks accelerated the bank’s liquidity problems. But a five month gap between suspicion and action, during which the reported numbers remained the only public view, is exactly the window in which depositors and creditors make decisions they would not make with full information.

There is also a harder question about forbearance. The same ABC Color reporting claims that two facilities granted by the BCP after the merger, covering the merger trust expenses and the classification of the delinquent portfolio, together amounted to about US$691 million. If that is accurate, part of the capital that later disappeared existed because the supervisor had permitted the treatment that created it. That is press reporting of leaked documents rather than an established fact, but it is the question any review of this failure will have to answer.

Finally there is the structure of supervision itself. Carvallo chaired the predecessor company Financiera Ueno from 2021 until mid 2023 before President Santiago Peña appointed him to lead the central bank. The BCP says he recused himself from every decision involving Ueno, and both Peña and the bank deny any wrongdoing. None of that has to be in dispute for the point to stand: an arrangement in which the head of the supervisor recently ran the supervised institution weakens the perceived independence of every decision the supervisor makes about it, whether that decision is to act or to wait. Carvallo appears to have recognised this himself when he resigned on the day of the announcement, saying it would help calm the controversy around the BCP.

2.3 Public money replaced market discipline

Private depositors and wholesale lenders discipline a bank by demanding a higher price, or leaving, when they doubt its health. Public sector deposits often do not behave that way, and Ueno had a lot of them. Of roughly US$2.85 billion in deposits at June, about US$2.02 billion (71%) came from the private sector, while around US$295 million were term deposits from the IPS social security institute and roughly US$532 million came from other public sector bodies. Bloomberg Línea reported that government deposits at the bank had soared since Peña took office in 2023, reaching about 29% of deposits.

{
  "type": "doughnut",
  "data": {
    "labels": ["Private sector (71%)", "Public sector: IPS term deposits (10%)", "Public sector: other bodies (19%)"],
    "datasets": [
      {
        "data": [2020, 295, 532],
        "backgroundColor": ["#2563eb", "#dc2626", "#f97316"]
      }
    ]
  },
  "options": {
    "plugins": {
      "title": { "display": true, "text": "Ueno deposit mix at June 2026, US$ millions: private vs public sector (bank's own disclosure)" }
    }
  }
}

Peña has said that the IPS allocates funds to the banks offering the best rates through competitive processes, and nothing here establishes otherwise. The structural point is that close to a third of the bank’s funding came from a source that was not pricing its risk the way a private lender would, and that allowed a fast growing bank to fund its balance sheet without facing the questions a nervous wholesale market would have asked. The cost of that now falls on the public: the IPS is seeking to recover approximately US$380 million held in Ueno bonds and term deposits, and 32,000 retirees who collected their pensions through the bank need to be moved elsewhere.

2.4 External gatekeepers looked at the same numbers

Ueno passed through more external scrutiny than most banks its size ever face. Fitch assigned its US$350 million notes a BB rating in March 2026, in line with the bank’s issuer rating. International investors bought the largest corporate bond in Paraguay’s history. OTP Bank, a large European banking group, became a shareholder with a total of US$47 million of capital, including a further US$17 million in May 2026, at a point when the BCP’s concerns about linked lending were already forming.

Fitch moved its outlook to negative on 16 October, noting heightened scrutiny of related party operations, the concentration of public sector funds, accounting practices and certain balance sheet items. That was after the press reports, not before them. None of this means those gatekeepers were careless; they mostly rely on audited financial statements and management disclosures, and they cannot see what a supervisor sees in its inspections. That is precisely the problem. When every external check consumes the same reported numbers, they are not independent checks at all; they are the same check repeated, and they fail together when the numbers are wrong.

2.5 Related party lending hid in the ownership structure

Lending to connected parties is the oldest warning sign in banking, and every jurisdiction has limits on it, so how does a bank breach them at scale? According to ABC Color’s reporting of supervisory documents, between September 2025 and May 2026 the bank disbursed around US$146 million to three companies that, on paper, belonged to employees of the controlling Grupo Vázquez, against a related party limit the newspaper calculated at roughly US$82 million, and some of the funds flowed on to other group businesses. The bank’s position was that it had cured an earlier breach of the limits in June, within the regulator’s deadline.

If the reporting is accurate, the mechanism is the important part. A related party limit is only as good as the definition of “related”, and a definition based on legal ownership is defeated by putting a company in an employee’s name. The BCP’s description of having to trace “the route of the money” before it could act suggests the connection was not visible in the structure; it was only visible in where the funds went after drawdown. Any control that looks only at who owns the borrower, and not at where the money ends up, will miss this every time.

2.6 Confidence broke at digital speed

When the doubts finally became public, they moved faster than any traditional plan assumes. Carvallo said that leaks of sensitive information accelerated the deterioration of Ueno’s liquidity. The same pattern played out at far larger scale at Silicon Valley Bank in March 2023, where customers withdrew US$42 billion in a single day, with a further US$100 billion scheduled to leave the next morning. A digital bank’s greatest strength, that customers can move money instantly from their phones, becomes the mechanism of its failure once confidence goes.

The resolution itself then imposes its own delay. Once a bank is in resolution its deposits are no longer available on demand, whether or not the app works, and depositors are repaid through the guarantee or by transfer. Law 2334/03 covers deposits up to 75 monthly minimum wages per depositor, with payment due within fifteen calendar days, extendable by a further fifteen, and the central bank estimates that about 97% of Ueno’s depositors are fully covered, a share of depositors rather than of deposit value. The BCP has also announced a first payment of up to 10 million guaraníes per depositor. So money leaves at digital speed when confidence breaks, but comes back at legal speed once the regulator steps in.

3. The pattern: every check ran slowly or was not independent

Put those six failures side by side and a pattern emerges. The bank’s own controls were stretched by growth and acquisition. The supervisor knew for five months but its findings were not public, and its independence was open to question. Public depositors supplied funding without demanding the price of risk. External gatekeepers relied on the same reported numbers. Related party limits were defeated by a definition based on paper ownership. And when the truth arrived, it arrived all at once.

None of these checks was absent. Each one either ran too slowly to matter, as the supervisory review did, or was not truly independent of the numbers it was checking, as the rating, the investors and the reported capital ratio were. That is the real lesson of Ueno, and it is far more uncomfortable than a list of regulatory responsibilities, because it suggests a bank can have every required check in place and still fail if those checks all depend on the same slow, management produced view of the balance sheet.

4. How would we know if it were happening to us?

The question I would take back to Capitec, and that I think every bank’s executive team should ask, is not whether we meet our obligations but how we would know if we stopped meeting them, faster than a supervisor, a rating agency or a newspaper would. Each line of defence that failed at Ueno suggests a piece of evidence worth demanding.

Questions only become useful when they can be tracked, so each risk also needs a measurable indicator. The examples below illustrate the kind of metric I mean; they are not a statement about where any particular bank currently stands.

5. Making assurance real time

If the common failure at Ueno was that every check either ran slowly or consumed the same management produced numbers, then the answer is not more checks of the same kind. It is assurance that runs on the bank’s underlying data rather than its reported summaries, and runs continuously rather than on a committee cycle.

Much of that data, from ledger postings to loan drawdowns to deposit movements, already exists in close to real time inside a modern bank. Beneficial ownership graphs can surface possible hidden related party exposures by connecting borrowers, directors, addresses and post drawdown flows, which is exactly the kind of tracing the BCP took months to do by hand. Automated reconciliations can flag capitalised or vendor spending that cannot be traced to an approved policy, an owner and a contract. Liquidity models can run continuously against live deposit data, simulating the departure of the largest depositors.

The limits matter. Live monitoring surfaces exceptions quickly, but it cannot by itself establish what a loan book is worth, whether a capitalised cost qualifies, or whether two apparently unrelated companies share an owner; those still require evidence and judgement, and any automated control can be defeated if the people meant to act on its alerts are not independent. What continuous assurance can do is shorten the time between something going wrong and someone being obliged to look at it, which is the gap Ueno fell through.

6. Conclusion

Ueno did not fail because nobody knew the rules. It failed because every check that was supposed to enforce them was either too slow or was looking at the same numbers as everyone else, and a bank that grew from finance company to national champion in under three years outran all of them.

Digital banking has made it possible to open accounts in minutes, move money in seconds and acquire millions of customers without building thousands of branches, yet many of the controls protecting those same institutions still operate on monthly reports, quarterly committees and annual audits. That asymmetry should concern every banking executive. The next generation of digital banking will not be defined simply by how quickly we can move money, but by how quickly we can identify when something is going wrong, how independently we can challenge it, and how effectively we can intervene before it becomes a crisis. We have made banking real time; now we need to make assurance real time too.

Sources

• Banco Central del Paraguay: Banco Central inicia el procedimiento de resolución de ueno bank
• Banco Central del Paraguay: Comunicado sobre el pago de la garantía de depósitos a los ahorristas de ueno bank
• Biblioteca y Archivo Central del Congreso: Ley 2334/03, Garantía de depósitos y resolución de entidades de intermediación financiera
• La Nación: Banco Central detalló las irregularidades que definieron la disolución de ueno bank
• ueno bank: Estados financieros 2025
• ueno bank: Carta abierta a la opinión pública (September 2026)
• ueno bank: USD 100 million capital plan announcement (29 October 2026)
• El Cronista: Paraguay interviene ueno bank
• Bloomberg Línea: Banco paraguayo Ueno busca reforzar su capital
• Rio Times: Paraguay’s Ueno Bank Plans US$100M Capital
• CB Insights: ueno bank, Fitch rating of senior unsecured notes
• ABC Color via Prensa Mercosur: Ueno movió US$ 146 millones hacia tres empresas vinculadas
• ABC Color via Prensa Mercosur: Empresas salvadoras le deben 153 millones de dólares a Ueno Bank
• The Paraguay Post: Regulators Take Over as Paraguay’s Ueno Bank Falters
• AP via ABC News: Paraguay seizes major digital bank tied to president
• Reuters via Bilyonaryo: Paraguay central bank chief resigns as digital lender ueno faces resolution
• Latin Times: Ueno Bank’s collapse strands 3 million customers
• Revista Plus: ueno bank llega a US$ 401 millones de patrimonio
• Hoy: Peña on IPS fund allocation (April 2025)
• CNBC: SVB customers tried to withdraw nearly all the bank’s deposits over two days